{"id":"CVE-2026-124943","kind":"vulnerability","aliases":["CVE-2026-124943"],"related":[],"title":"Firefox: use-after-free in Layout component may let attackers run code","description":"Use-after-free in the Layout component. This vulnerability was fixed in Firefox 160.","summary":"Firefox has a use-after-free bug in its Layout component, which handles how page content is arranged. Memory bugs like this can let a malicious web page crash the browser or run code on the visitor's computer.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Firefox","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["browser","firefox","other"],"not_affected_if":["firefox-160-or-later"],"how_to_check":"- Check the installed Firefox version in Help > About Firefox","fix":"- Firefox: move to `160` or later, per the source","status":"open","published_at":"2026-11-10T14:17:28+00:00","first_seen_at":"2026-11-10T14:22:19+00:00","triaged_at":"2026-11-10T14:24:03+00:00","updated_at":"2026-11-10T14:24:03+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-10T14:24:03Z","model":"claude-haiku-5-5","output":{"fix":"- Firefox: move to `160` or later, per the source","reach":"internet","title":"Firefox: use-after-free in Layout component may let attackers run code","impact":"high","summary":"Firefox has a use-after-free bug in its Layout component, which handles how page content is arranged. Memory bugs like this can let a malicious web page crash the browser or run code on the visitor's computer.","audience":"everyone","category":"other","nicknames":[],"who_cares":["firefox","browser"],"confidence":0.5,"fix_status":"available","needs_auth":"no","worst_case":"malicious web page may run code in the browser","analyst_note":"Confirm the affected version range and the Mozilla advisory for this CVE, since the source gives only the fixed version and no severity.","how_to_check":"- Check the installed Firefox version in Help > About Firefox\n- unknown otherwise","plain_action":"Update Firefox to version 160 or later: open the menu, choose Help > About Firefox, and let it install the update.","product_name":"Firefox","needs_analyst":true,"not_affected_if":["firefox-160-or-later"],"who_is_affected":"Anyone running Firefox older than version 160 is exposed, since the flaw is in the browser's page layout code. Standard browsing of untrusted web pages is the main path. The sources do not say whether any non-default setting is required.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000703,"input_tokens":4451,"output_tokens":515,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124943':16A,19A '-2026':15A,18A '160':77C 'arrang':41B 'attack':11A 'browser':21B,54B 'bug':30B,43B 'code':13A,57B 'compon':8A,34B,70C 'comput':62B 'content':39B 'crash':52B 'cve':14A,17A 'firefox':1A,20A,22B,23B,76C 'fix':74C 'free':5A,29B,66C 'handl':36B 'layout':7A,33B,69C 'let':10A,47B 'like':44B 'malici':49B 'may':9A 'memori':42B 'page':38B,51B 'run':12A,56B 'use':3A,27B,64C 'use-after-fre':2A,26B,63C 'visitor':60B 'vulner':72C 'web':50B","nicknames":[],"mitigations":[],"who_affected":"Anyone running Firefox older than version 160 is exposed, since the flaw is in the browser's page layout code. Standard browsing of untrusted web pages is the main path. The sources do not say whether any non-default setting is required.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Firefox to version 160 or later: open the menu, choose Help > About Firefox, and let it install the update.","pkeys":["firefox"],"ptokens":["firefox"],"labels":["browser","firefox","other","unknown","vendor"],"campaign_type":null,"search_a":"'-124943':16A,19A '-2026':15A,18A 'attack':11A 'code':13A 'compon':8A 'cve':14A,17A 'firefox':1A,20A 'free':5A 'layout':7A 'let':10A 'may':9A 'run':12A 'use':3A 'use-after-fre':2A","search_b":"'arrang':41B 'browser':21B,54B 'bug':30B,43B 'code':57B 'compon':34B 'comput':62B 'content':39B 'crash':52B 'firefox':22B,23B 'free':29B 'handl':36B 'layout':33B 'let':47B 'like':44B 'malici':49B 'memori':42B 'page':38B,51B 'run':56B 'use':27B 'use-after-fre':26B 'visitor':60B 'web':50B","search_c":"'160':77C 'compon':70C 'firefox':76C 'fix':74C 'free':66C 'layout':69C 'use':64C 'use-after-fre':63C 'vulner':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T14:17:28+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124943","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124943","severity":null,"published_at":"2026-11-10T14:17:28+00:00","modified_at":"2026-11-10T14:17:28+00:00","first_seen_at":"2026-11-10T14:22:19+00:00","fetched_at":"2026-11-10T14:22:19+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}